MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a867e908995563dad71a115e74f73d0449ba21dc62310b2e0b2e179e399a4d73. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AsyncRAT


Vendor detections: 16


Intelligence 16 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a867e908995563dad71a115e74f73d0449ba21dc62310b2e0b2e179e399a4d73
SHA3-384 hash: 736b0e47bd6c9c554fd1db12247fd45b1bd45eaf998c6c688b91eba2b2ea6920357c9dd3808ac59980bb627842c26819
SHA1 hash: c3ef7054076bd4aa238d998543cf1d247009e8f3
MD5 hash: 25bdc29533d15c9f924b552f2ed516e5
humanhash: hawaii-east-leopard-delaware
File name:L2t3Du6.exe
Download: download sample
Signature AsyncRAT
Create hunting rule
File size:19'306'697 bytes
First seen:2025-09-25 13:30:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 40ab50289f7ef5fae60801f88d4541fc (59 x ValleyRAT, 49 x Gh0stRAT, 41 x OffLoader)
ssdeep 393216:Hf5IMAAO8lRee6V874YeM38QXqTSLWsghBu+6VxXd3ogB+XDewRf9D3ZTR4O:/1TOmR6VfJE/XqSSHh8TVPryP4O
TLSH T17D17332372C7E53EF09E4B3712B2D599A9F767619822BE26C6E4446CCF250101E3F746
TrID 60.0% (.EXE) Inno Setup installer (107240/4/30)
23.2% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
5.8% (.EXE) Win64 Executable (generic) (10522/11/4)
3.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
2.5% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter abuse_ch
Tags:AsyncRAT exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
149
Origin country :
SE SE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
a867e908995563dad71a115e74f73d0449ba21dc62310b2e0b2e179e399a4d73.exe
Verdict:
Suspicious activity
Analysis date:
2025-09-25 10:28:53 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/85cf3231-49a9-43fd-9f06-512709dadc49

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/29023/
Detection(s):
no reply from clamd
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68d552d0cc9425144151e6c4
Tags:
dropper remo
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for synchronization primitives
Restart of the analyzed sample
Creating a process with a hidden window
Creating a file
Moving a recently created file
Moving a file to the %temp% subdirectory
Enabling the 'hidden' option for recently created files
Launching the default Windows debugger (dwwin.exe)
Creating a file in the %AppData% subdirectories
Connection attempt
Using the Windows Management Instrumentation requests
Sending a custom TCP request
Unauthorized injection to a system process
Setting a global event handler for the keyboard
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context embarcadero_delphi fingerprint installer obfuscated overlay packed packer_detected threat
Link:
https://www.filescan.io/uploads/68d544466c140e5b35fe342d/reports/8cfa8ba2-2e9d-4d53-b73b-6991a8c60893/overview
Verdict:
Suspicious
Labled as:
VHO:TrojanDrop.Convagent.gen
Link:
https://www.hybrid-analysis.com/sample/a867e908995563dad71a115e74f73d0449ba21dc62310b2e0b2e179e399a4d73
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-25T07:43:00Z UTC
Last seen:
2025-09-25T07:43:00Z UTC
Hits:
~100
Detections:
Trojan.Win64.DonutInjector.sb Trojan.Win64.Donut.sb HEUR:Backdoor.MSIL.NanoBot.gen Backdoor.MSIL.Crysan.sb Backdoor.MSIL.Crysan.lij Trojan.Win32.Shellcode.sb Trojan.Win32.PoolInject.sba Trojan.MSIL.Donut.sb Backdoor.MSIL.Agent.sb
Link:
https://opentip.kaspersky.com/a867e908995563dad71a115e74f73d0449ba21dc62310b2e0b2e179e399a4d73/results?tab=lookup
Result
Threat name:
DcRat
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1784125
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Connects to many ports of the same IP (likely port scanning)
Contains functionality to log keystrokes (.Net Source)
Found direct / indirect Syscall (likely to bypass EDR)
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Suricata IDS alerts for network traffic
Tries to detect sandboxes / dynamic malware analysis system (Installed program check)
Writes to foreign memory regions
Yara detected DcRat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1784125 Sample: L2t3Du6.exe Startdate: 25/09/2025 Architecture: WINDOWS Score: 100 57 Suricata IDS alerts for network traffic 2->57 59 Malicious sample detected (through community Yara rule) 2->59 61 Yara detected DcRat 2->61 63 4 other signatures 2->63 11 L2t3Du6.exe 2 2->11         started        process3 file4 49 C:\Users\user\AppData\Local\...\L2t3Du6.tmp, PE32 11->49 dropped 14 L2t3Du6.tmp 3 5 11->14         started        process5 file6 51 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 14->51 dropped 53 C:\Users\user\AppData\Local\...\_iscrypt.dll, PE32 14->53 dropped 17 L2t3Du6.exe 2 14->17         started        process7 file8 39 C:\Users\user\AppData\Local\...\L2t3Du6.tmp, PE32 17->39 dropped 20 L2t3Du6.tmp 5 15 17->20         started        process9 file10 41 C:\ProgramData\206\ws2_32-unXS.exe (copy), PE32+ 20->41 dropped 43 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 20->43 dropped 45 C:\Users\user\AppData\Local\...\_iscrypt.dll, PE32 20->45 dropped 47 7 other files (none is malicious) 20->47 dropped 23 ws2_32-unXS.exe 1 20->23         started        process11 signatures12 69 Writes to foreign memory regions 23->69 71 Allocates memory in foreign processes 23->71 73 Found direct / indirect Syscall (likely to bypass EDR) 23->73 26 sihost.exe 23->26 injected 29 ws2_32-unXS.exe 23->29         started        31 dwm.exe 23->31 injected process13 signatures14 75 Writes to foreign memory regions 26->75 77 Allocates memory in foreign processes 26->77 33 smartscreen.exe 1 6 26->33 injected 37 RuntimeBroker.exe 3 26->37 injected process15 dnsIp16 55 108.187.0.52, 123, 49695, 49702 LEASEWEB-USA-LAX-11US United States 33->55 65 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 33->65 67 Tries to detect sandboxes / dynamic malware analysis system (Installed program check) 33->67 signatures17
Score:
70%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/a867e908995563dad71a115e74f73d0449ba21dc62310b2e0b2e179e399a4d73
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/25bdc29533d15c9f924b552f2ed516e5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a867e908995563dad71a115e74f73d0449ba21dc62310b2e0b2e179e399a4d73/
Verdict:
Malicious
Threat:
Family.ASYNCRAT
Link:
https://tip.neiki.dev/file/a867e908995563dad71a115e74f73d0449ba21dc62310b2e0b2e179e399a4d73
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-09-25 10:28:55 UTC
File Type:
PE (Exe)
Extracted files:
11
AV detection:
9 of 24 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vbt6scezkvr5vvy2cfphj5z5are3uio4miyqwlqlfylz4om2jvzq._file
Verdict:
malicious
Label(s):
asyncrat
Create hunting rule
Similar samples:
error
AsyncRAT
Result
Malware family:
n/a
Score:
  8/10
Tags:
adware discovery persistence ransomware spyware
Link:
https://tria.ge/reports/250925-qstdwayly2/
Behaviour
Checks SCSI registry key(s)
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Enumerates connected drives
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Boot or Logon Autostart Execution: Active Setup
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/110d7128-4575-4d99-9cc1-eb7e986a56aa
Unpacked files
SH256 hash:
a867e908995563dad71a115e74f73d0449ba21dc62310b2e0b2e179e399a4d73
MD5 hash:
25bdc29533d15c9f924b552f2ed516e5
SHA1 hash:
c3ef7054076bd4aa238d998543cf1d247009e8f3
Link:
https://www.unpac.me/results/fffee38f-0c44-4959-8935-650a9ec5d4c1/
SH256 hash:
a7ad13b14496a9e3023bb016cf96b0cf61f41d36410013fbb5ff7659aa31cc05
MD5 hash:
08d411a14b735168cccc334d547bdc3e
SHA1 hash:
59d48ea28af3f12031b2f48717ec4b2690cac598
Link:
https://www.unpac.me/results/fffee38f-0c44-4959-8935-650a9ec5d4c1/
Malware family:
DonutLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a867e9089955/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a867e908995563dad71a115e74f73d0449ba21dc62310b2e0b2e179e399a4d73

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:botnet_plaintext_c2
Create hunting rule
Author:cip
Description:Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AsyncRAT

Executable exe a867e908995563dad71a115e74f73d0449ba21dc62310b2e0b2e179e399a4d73

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3631718/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/29023/

Comments